“What can I deploy today, and what will it cost me in noise?”
Sigma packs for endpoint and network telemetry and YARA samples for files and memory. Every rule ships with the false positives it was written expecting, because a rule deployed without them gets switched off in a fortnight.
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
